Extracted

Extracted

Extracted

• • Target

    ecb01d7f140ad632a0d1dbc641d961c1fb83520b5c8d4010038c084757825387

  • Size

    217KB

  • MD5

    d722704eff46ac5ca68723e9d35e9c81

  • SHA1

    c08f9166337b98a774fd43b771c652bead0b57af

  • SHA256

    ecb01d7f140ad632a0d1dbc641d961c1fb83520b5c8d4010038c084757825387

  • SHA512

    80f2c9d8e5f630e1b2b511a7460a31c4b98ff8e628fecba33546205a00c11b5638a484c559b7c466cb7d2f2bc9f92b791fa7ab4e7d15cc55c4a0ff65de7a0e9b

  • SSDEEP

    6144:DHfZ8S+RSDnm9WwgFyzE9P08R5HYjWjm:TfZ8S+ILm9PgFyzO08R5f

  Score

  10^/10

  amadeysmokeloaderpub1backdoorspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2